1 00:00:00,000 --> 00:00:04,680 I'll step first into the profile. 2 00:00:04,680 --> 00:00:09,720 So here's where, in this system, I've loaded in a couple of the profiles from the library. 3 00:00:10,800 --> 00:00:13,680 So we were looking before at that Windows profile. 4 00:00:14,080 --> 00:00:20,040 So if we want to use an agent approach, here's a profile that I can point and click assign to hosts. 5 00:00:20,540 --> 00:00:27,580 As I've done here, I'll go into assign hosts, and here you'll see the three Windows machines that are being monitored are assigned this profile. 6 00:00:28,200 --> 00:00:32,200 This is how I can rapidly get monitoring coverage to lots of devices. 7 00:00:32,720 --> 00:00:33,200 Right. 8 00:00:33,320 --> 00:00:38,020 So essentially, like you're saying, you have these hosts or servers or boxes or whatever out there, 9 00:00:38,040 --> 00:00:43,220 and you're saying, here's the grouping of parameters or attributes or whatever I want to monitor, the profiles. 10 00:00:43,520 --> 00:00:47,720 And you want to start monitoring that stuff on those three boxes that you have. 11 00:00:48,260 --> 00:00:48,700 Correct. 12 00:00:49,920 --> 00:00:55,720 I can apply this profile right from here and then activate the configuration, 13 00:00:55,720 --> 00:00:59,560 and I'll be processing those checks against those hosts. 14 00:00:59,720 --> 00:01:04,500 So Profile Importer is a library of where all of the possible profiles I may want to use are available. 15 00:01:04,500 --> 00:01:11,160 Well, I'm guessing from looking at the XML extension here that while there seems to be a fair amount of these that sort of ship out of the box, 16 00:01:11,240 --> 00:01:16,340 that people could import these during runtime or even make up their own profiles to import. 17 00:01:17,720 --> 00:01:18,440 That's correct. 18 00:01:19,000 --> 00:01:26,460 You can create, again, follow the open schema that the files are using, and then you can import them. 19 00:01:26,600 --> 00:01:35,100 So we saw before the Groundwork Connect site, if I had just downloaded an XML file that had some profile information, I could do that right here. 20 00:01:35,860 --> 00:01:38,580 So as an example, I actually just uploaded a couple of these. 21 00:01:38,660 --> 00:01:40,920 These are some new plug-ins that we're working with. 22 00:01:41,820 --> 00:01:45,460 I can upload them right from this interface and then load them. 23 00:01:47,380 --> 00:01:48,260 You know what I'll do? 24 00:01:48,320 --> 00:01:49,380 I'll redo this one. 25 00:01:49,700 --> 00:01:54,360 We should get an error. 26 00:01:59,180 --> 00:02:07,080 Okay, so I've already uploaded this, and it's telling you that I can't upload that. 27 00:02:07,440 --> 00:02:07,820 All right. 28 00:02:07,960 --> 00:02:10,280 So it doesn't let you overwrite existing things. 29 00:02:10,380 --> 00:02:12,440 Yeah, it wouldn't let me overwrite the one that was there. 30 00:02:13,780 --> 00:02:17,300 But this is actually the profile that was loaded in. 31 00:02:18,180 --> 00:02:26,700 And what this is is an SLA model that we've provided customers that allows you to group things together for service level monitoring. 32 00:02:27,920 --> 00:02:30,560 We get a lot of requests for cluster monitoring. 33 00:02:30,800 --> 00:02:34,300 You know, I have three or four MySQL servers or MS SQL servers. 34 00:02:34,760 --> 00:02:36,560 Don't tell me that one of them is down. 35 00:02:36,720 --> 00:02:39,380 Tell me that, you know, one of them is left. 36 00:02:39,900 --> 00:02:42,620 And that's something possible with these group checks that you see. 37 00:02:42,860 --> 00:02:46,560 Flexibility that people really like about this product. 38 00:02:46,560 --> 00:02:50,760 So whether it's SSH, whether it's SNMP, do I want to put an agent on there, 39 00:02:50,860 --> 00:02:55,260 or do I want to, without an agent, say, on a Windows machine, monitor an MS SQL? 40 00:02:56,420 --> 00:03:00,660 So you'll see that if somebody, it's one thing to say I want to monitor my MS SQL. 41 00:03:01,200 --> 00:03:06,400 It's another thing to kind of separate what I can do with open source versus what I should do. 42 00:03:06,900 --> 00:03:11,920 And here's an example where all predefined for you are things like watching for buffer cache hits, 43 00:03:12,600 --> 00:03:15,240 deadlocks, other waits, and so forth. 44 00:03:15,240 --> 00:03:21,020 That came from our work with customers in monitoring that particular application in production. 45 00:03:21,900 --> 00:03:22,020 Right. 46 00:03:22,580 --> 00:03:27,480 And is that typical that with the sort of, I don't know what you would call them, 47 00:03:27,480 --> 00:03:29,860 sort of default or out-of-the-box profiles that you have, 48 00:03:29,900 --> 00:03:33,740 that you might add different parameters for each version, sort of updating and refining them? 49 00:03:34,480 --> 00:03:34,840 Yep. 50 00:03:35,240 --> 00:03:36,760 So this is the grouping. 51 00:03:36,900 --> 00:03:41,840 So let's say, for example, we wanted to go into this buffer cache hit service. 52 00:03:42,560 --> 00:03:44,880 Again, before we would want to run our scan, 53 00:03:45,360 --> 00:03:49,520 we may want to be, we want to know what profiles we might automatically assign. 54 00:03:50,220 --> 00:03:52,980 So here I come in, and this is going to take me into a quick search 55 00:03:52,980 --> 00:03:55,240 through all of the services that are configured. 56 00:03:56,100 --> 00:03:58,260 So I'm going to drill down into the actual config. 57 00:03:59,460 --> 00:04:02,860 As you get familiar with the capabilities of Nagios in this screen, 58 00:04:02,960 --> 00:04:04,420 you'll see things like mouse over help. 59 00:04:04,520 --> 00:04:08,160 That's always useful to know what the different metrics can do. 60 00:04:09,240 --> 00:04:11,560 But now when I come down to the actual service check, 61 00:04:12,200 --> 00:04:15,660 here you'll see the values that are assigned in it. 62 00:04:16,200 --> 00:04:19,300 And in this case, this particular check is going to be giving, 63 00:04:19,480 --> 00:04:21,900 it has predefined thresholds of 80 and 50. 64 00:04:22,840 --> 00:04:25,680 So in this case, we're going to warn when the cache hit rates 65 00:04:25,680 --> 00:04:27,300 on those buffers are at 80%. 66 00:04:27,300 --> 00:04:31,240 Generally, you want caches to be at 99%, right? 67 00:04:31,300 --> 00:04:32,840 That means that the cache is being effective. 68 00:04:33,740 --> 00:04:36,640 So in this case, the value of 80% would create a warning, 69 00:04:37,340 --> 00:04:41,040 and the threshold of 50 would represent a critical. 70 00:04:41,680 --> 00:04:46,700 If I knew my databases and said, well, I want to know about it at 90, 71 00:04:46,820 --> 00:04:49,000 that's a warning if it falls below 90. 72 00:04:49,440 --> 00:04:52,180 And the critical is if it falls below 85. 73 00:04:53,100 --> 00:04:55,440 By making that change here and saving it, 74 00:04:55,500 --> 00:05:00,620 not every machine that has that service check can be updated through the profile. 75 00:05:00,620 --> 00:05:03,180 So let's now go to the discovery. 76 00:05:04,020 --> 00:05:10,680 So we started with Groundwork providing and actually contributing back an extension for Nagios 77 00:05:10,680 --> 00:05:12,700 to provide a web-based configuration. 78 00:05:13,960 --> 00:05:17,440 Natively, Nagios is a text file configuration. 79 00:05:18,240 --> 00:05:22,060 We then extended it with 5.2 and added some discovery features to it. 80 00:05:22,520 --> 00:05:29,080 So sometimes users will need a more rapid way to build a configuration, 81 00:05:29,080 --> 00:05:33,240 and auto-discovery takes that in a new direction for us. 82 00:05:34,580 --> 00:05:39,560 So for starters, let me first go in and talk first about the definitions. 83 00:05:39,840 --> 00:05:44,180 So here you'll see a basic template as part of Professional that's combining TCP and SNMP. 84 00:05:44,960 --> 00:05:47,400 I'm going to click on Edit on this template. 85 00:05:47,400 --> 00:05:52,980 And you'll see that I have defined a couple of methods along with the discovery. 86 00:05:53,280 --> 00:05:58,380 Now this is set for interactive, so I can watch what the system is doing, 87 00:05:58,580 --> 00:06:04,660 or I can automate the process of adding hosts and even removing them if I wanted to. 88 00:06:04,740 --> 00:06:06,940 I'll first stop on what we're doing with Nmap. 89 00:06:07,300 --> 00:06:11,260 So when I run the scan, it's going to use these variables that we've set up on Nmap. 90 00:06:12,540 --> 00:06:15,100 And we're also going to be checking SNMP. 91 00:06:15,440 --> 00:06:20,400 If I have SNMP read strings that I need to enter, I can put in a whole list of read strings. 92 00:06:20,960 --> 00:06:26,600 And this will help drive what services are going to be assigned automatically to the SNMP devices. 93 00:06:26,900 --> 00:06:30,100 Let's go and just look again at ranges. 94 00:06:30,260 --> 00:06:32,400 So I'm just going to do a quick scan. 95 00:06:32,400 --> 00:06:34,160 Now I've got an example set up. 96 00:06:34,780 --> 00:06:37,320 And the application does tell me that, hey, I ran a discovery. 97 00:06:37,460 --> 00:06:38,680 You've got hosts to process. 98 00:06:39,320 --> 00:06:43,220 I'm just going to click a Start New Discovery for demo purposes. 99 00:06:44,160 --> 00:06:48,140 Again, little things about making open source enterprise, things like, hey, you know, 100 00:06:48,320 --> 00:06:51,060 your security guys might not like you to run an Nmap. 101 00:06:51,320 --> 00:06:53,240 So a little warning there for you. 102 00:06:53,360 --> 00:06:56,160 You're about to freak out the network people and the security people. 103 00:06:56,320 --> 00:06:56,880 So get ready. 104 00:06:57,580 --> 00:06:57,940 Exactly. 105 00:06:58,320 --> 00:07:02,020 And again, fortunately, you can't tune what Nmap options you're going to use. 106 00:07:02,460 --> 00:07:06,480 Perhaps with Groundwork support, you may want to tone it down. 107 00:07:06,560 --> 00:07:11,900 But it's kind of mild, not really setting off a lot of bells. 108 00:07:12,840 --> 00:07:14,720 So it's gone through its discovery stage. 109 00:07:14,760 --> 00:07:16,400 Again, it only used one IP address. 110 00:07:16,520 --> 00:07:18,920 But it found a new host called CentOS. 111 00:07:19,280 --> 00:07:22,280 So it's going to resolve the hosts when it finds IP addresses. 112 00:07:22,900 --> 00:07:24,860 And it found that my host is called CentOS. 113 00:07:24,940 --> 00:07:26,880 And it did find that it is a Linux machine. 114 00:07:27,940 --> 00:07:32,000 You'll see it attempted to do an SNMP scan, but there were no hosts to scan. 115 00:07:32,300 --> 00:07:35,240 So as a host is discovered, we see the SNMP running. 116 00:07:35,680 --> 00:07:37,800 If it is, we would then have done a walk on it. 117 00:07:37,800 --> 00:07:38,700 We found our one host. 118 00:07:39,160 --> 00:07:40,260 We want to click Next. 119 00:07:41,240 --> 00:07:42,760 And now it brings me into a review. 120 00:07:42,960 --> 00:07:45,400 What did we set up on this host? 121 00:07:46,040 --> 00:07:49,060 Well, we set up the basic discovery. 122 00:07:49,220 --> 00:07:51,060 It's going to use a basic profile here. 123 00:07:52,000 --> 00:07:57,840 And what it found on this host happens to be three open ports where it assigned these three profiles. 124 00:08:00,640 --> 00:08:07,440 If I wanted to add this as it is, I can select it and then click Add. 125 00:08:09,000 --> 00:08:13,280 But before we do that, let's go in and take a look at the actual services. 126 00:08:18,380 --> 00:08:23,240 And if I now wanted to add new services, I can do so here. 127 00:08:24,660 --> 00:08:28,660 So maybe I have some SSH checks that I wanted to run on it or load checks. 128 00:08:29,440 --> 00:08:31,020 I can add those at this time. 129 00:08:31,800 --> 00:08:34,300 It also assigned it to the host group Linux servers. 130 00:08:35,780 --> 00:08:38,620 And I can also now choose specific profiles. 131 00:08:42,820 --> 00:08:48,560 And let's go back and just take what we've been given in the interface. 132 00:08:50,420 --> 00:08:51,260 Process that. 133 00:08:51,680 --> 00:08:53,360 And now we've just added that new host. 134 00:08:59,440 --> 00:09:04,820 And then I would assume it's going to, we'll start being able to see it in the status panel or whatnot. 135 00:09:04,900 --> 00:09:06,180 So you'll see it just came back. 136 00:09:06,680 --> 00:09:10,040 It reported success on the commit in the foundation synchronization. 137 00:09:10,560 --> 00:09:11,900 It reloaded Nagius. 138 00:09:12,020 --> 00:09:14,600 And now this host is set up for monitoring of those ports. 139 00:09:14,680 --> 00:09:18,180 Now we can get very fancy with what happens when it's finding a host there. 140 00:09:19,140 --> 00:09:20,940 And I'm going to come to the automation scheme. 141 00:09:21,080 --> 00:09:27,260 And this is where those decisions were made to assign the SSH alive and other items. 142 00:09:27,900 --> 00:09:28,360 All right. 143 00:09:30,100 --> 00:09:34,860 So basically what Groundwork is doing with NMAP and the SNMP walk is we're creating a text file. 144 00:09:37,400 --> 00:09:43,560 And then from that text file, we're learning out a schema that says in that text file, column 1 is the name. 145 00:09:43,840 --> 00:09:44,960 Column 2 is the alias. 146 00:09:45,460 --> 00:09:47,780 And then we can set up some task names. 147 00:09:49,380 --> 00:09:53,080 So as you'll see here on task 2, I'm going to click on assign name. 148 00:09:54,760 --> 00:10:02,700 And based on column 2, whatever that value is, as is, we're going to assign the value there to the object name in the configuration. 149 00:10:07,280 --> 00:10:16,320 In step 7, or I should say in column 7, is where I can specify that there's a service profile to be specified. 150 00:10:18,720 --> 00:10:24,560 Now we'll see that when it gets on that, here are the tasks that we can run against that piece of data. 151 00:10:25,980 --> 00:10:26,420 Right. 152 00:10:26,560 --> 00:10:30,380 So essentially, like you're saying, you have this text file with various columns. 153 00:10:30,480 --> 00:10:35,740 And now you're mapping it to the different aspects or attributes of that host that you're interested in. 154 00:10:35,820 --> 00:10:39,760 And then even, like you're saying, attaching new actions to it or tasks. 155 00:10:40,400 --> 00:10:40,740 Correct. 156 00:10:40,840 --> 00:10:44,700 Well, let's go back and check on our host that we just created. 157 00:10:46,900 --> 00:10:48,740 So the name of that host was Centos. 158 00:10:54,680 --> 00:10:58,520 And here he is now happily being monitored by Nagios. 159 00:11:02,120 --> 00:11:03,960 We've got two warnings already. 160 00:11:04,420 --> 00:11:06,820 And now we can see activity that's coming back. 161 00:11:08,240 --> 00:11:13,840 This is an example of groundwork correlating events for hosts together with the Nagios state. 162 00:11:14,320 --> 00:11:19,180 When I go into the event console, this is another new feature of version 5.2. 163 00:11:19,640 --> 00:11:25,780 This is where we have more of, again, NOC style type of an interface for all kinds of events. 164 00:11:26,140 --> 00:11:26,280 Right. 165 00:11:26,400 --> 00:11:33,100 The more traditional show me the river of events sort of things with, of course, filtering and all of that stuff. 166 00:11:33,760 --> 00:11:34,000 Exactly. 167 00:11:34,320 --> 00:11:39,320 Instead of it being only seeing events relative to the service or the host that we were looking at in the previous few. 168 00:11:40,320 --> 00:11:40,620 That's right. 169 00:11:40,620 --> 00:11:40,920 That's right. 170 00:11:41,040 --> 00:11:43,780 So here I can search and look for messages. 171 00:11:44,540 --> 00:11:48,960 And I can see, okay, here was a trap that came in with warm in the message type. 172 00:11:49,280 --> 00:11:49,480 Uh-huh. 173 00:11:49,480 --> 00:11:52,720 I can change this to a different operational status. 174 00:11:53,220 --> 00:11:59,940 And you'll see also the same host groups apply because I can now look, say, at my New York routers again from this particular console. 175 00:12:02,880 --> 00:12:10,500 If I wanted to look at all of the accepted traps, I can sort and sift them as I like. 176 00:12:10,760 --> 00:12:16,200 But more and more, customers are liking the approach of, well, I'm only going to be in the screen if there's a problem. 177 00:12:16,560 --> 00:12:23,160 And if Nagios can help me stay out of that screen unless there's a real problem, I don't have to try to digest lots of messages. 178 00:12:23,480 --> 00:12:23,620 Right. 179 00:12:23,780 --> 00:12:32,800 So what you're saying is people don't really like to be in the, and looking at events, right, it's nicer just to look at services and hosts, to get that higher level view of things. 180 00:12:32,880 --> 00:12:34,100 that's right